Block Single IP requesting multiple domains

Post Reply
wharminda
Junior Member
Posts: 2
Joined: 25 Jul 2022, 12:52

Block Single IP requesting multiple domains

Post by wharminda »

I'm getting a lot of single IP's hitting multiple domains on a server in a DDOS attack. Something like this - 1x IP (sometimes 3, 4 or more) calling:

domain1/index.php
domain2/index.php
domain3/index.php
domain4/index.php
etc

Often they will call 20 url's on the single domain and hit 5,10,20 domains at once, over loading the server. Some of the URL's exist, some don't.

A simple way to block this, is to auto block any IP that hits more than x url's/second and/or x Domains/second. Needs to be an over ride option to allow for CDN's and the odd genuine reason for doing so.
Sergio
Junior Member
Posts: 1685
Joined: 12 Dec 2006, 14:56

Re: Block Single IP requesting multiple domains

Post by Sergio »

If you have a LOG line about this attack, it will be great to see it, that will give an idea on what you can use to stop it.

Sergio
Post Reply